CVE-2026-6924

Weak entropy initialization in Silicon Labs Matter SiWx917 TinyCrypt path

High8.7EPSS 0.45%

Published: 23 Jul 2026
Updated: 24 Jul 2026
Reserved: 23 Apr 2026
Assigned by: Silabs

Description

A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated.

Scores

CVSS scores of CVE-2026-6924, by who scored it
Scored by	CVSS	Score	Vector
SilabsCNA (assigner)	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
NVDNVD · Awaiting Analysis	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.45% · top 61% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) (opens in a new tab)All about CWE-336 and its CVEs

Affected products

Silicon Labs · Silicon Labs Matter Github
- affected 0

References (2)

https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/a45Vm0000009SzZIAU?operationContext=S1 (opens in a new tab)vendor-advisorypermissions-required
https://github.com/SiliconLabs/matter/tree/release_2.3.1-1.3 (opens in a new tab)patch

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-6924](https://trackcve.app/badge/CVE-2026-6924.svg)](https://trackcve.app/cve/CVE-2026-6924)

Record last updated 24 Jul 2026, 13:40 UTC.